For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ask_me_anytime_'s avatar
ask_me_anytime_
Icon for Nimbostratus rankNimbostratus
Apr 15, 2010

ServerSSL - SERVERSSL_HANDSHAKE not triggered on certificate check failiure ??

Hello,   during serverSSL handshake, i'm trying to log messages when pool member server ssl certificate is invalid (expired certificate ) and BIGIP rejects it.   In the serverssl profile, i set...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Apr 15, 2010
In a quick test on a 10.1.0 test unit, when I set the cert mode to require and the server sends an expired cert, the SERVERSSL_HANDSHAKE event isn't triggered.

When I change the server SSL profile's cert mode to ignore, then no cert count is returned with [SSL::cert count]. So I'm not sure this is possible. 


when SERVERSSL_HANDSHAKE {
   log local0. "Connected to [IP::server_addr]:[TCP::server_port]"
   log local0. "Cert count: [SSL::cert count]"

: Connected to 10.41.0.23:443

: Cert count: 0

Anyone else have ideas? If not, maybe you could open a case with F5 Support and ask about this. If you do and get an answer, could you reply back here for future reference?

Thanks, Aaron